| Concept | Meaning |
|---|---|
| User | A Lucion ID account with verified identity data and passkeys. |
| Organization | A tenant boundary containing memberships, policies, roles, applications, and audit context. |
| Membership | A user's relationship to an organization, including role and status. |
| Application | A registered integration with redirect URIs, scopes, and client identity. |
| Scope | A least-privilege permission requested by an OAuth client or API credential. |
| Session | A server-side authenticated browser session represented by a secure HttpOnly cookie. |
| Delegation | A policy-bound authorization decision for Lyra; it is not universal access. |
A client-supplied organization ID never overrides the authenticated application's owner organization. Scope evaluation and object access remain tenant-bound.